[SSSD] [PATCH] Split the providers into separate subpackages

Jakub Hrozek jhrozek at redhat.com
Mon Jun 10 08:03:51 UTC 2013


On Fri, Jun 07, 2013 at 06:24:48PM +0200, Lukas Slebodnik wrote:
> 1. I like idea of divided subpackages. If someone wants only ldap backend, he
> needn't install samba-libs (and its dependencies)
> 
> 2. There isn't any rpmlint warnings.
> 
> I tested yum upgrade upgrade with installed sssd and freeipa-client.
> New packages were installed for dependencies:
>    sssd-ad sssd-common sssd-ipa sssd-krb5 sssd-krb5-common sssd-ldap
> Everything worked as expected.
> 
> Then I decided to remove sssd-ad:
>    yum remove sssd-ad
> and packeges "freeipa-client, sssd" were also removed.
> I was little bit confused, because I didn't want to remove sssd
> and sssd replied to getent command after packages "freeipa-client, sssd" were
> removed.

That's because freeipa-client currently requires sssd, we might want open a
ticket to make them require just sssd-ipa.

> 
> I think, that other users may be also confused with this situation.
> Then I looked to the patch and I found out, that:
>   --sssd is only "meta package",which require all backedns subpackages
>   --sssd doesn't contain any useful files
>   --everything important is in package sssd-common.
> 
> 
> Maybe we should update package description of sssd and sssd-common.
> I hope that system administrators relies on output of "yum info"
> and there isn't it very well explained.
> 

Thanks, I updated the summary of both sssd and sssd-common. Hopefully it
would be clearer now.

> Summary:
> Everything works well, but I was little bit confused.
> 
> Any other opinions?
> 
> One nitpick inline
> 
> 
> >+%package krb5-common
> >+Summary: SSSD helpers needed for Kerberos and GSSAPI authentication
> >+Group: Applications/System
> >+License: GPLv3+
> >+Conflicts: sssd < %{version}-%{release}
> >+Requires: cyrus-sasl-gssapi
> >+Requires: sssd-common = %{version}-%{release}
> >+Requires: sssd-krb5-common = %{version}-%{release}
>             ^^^^^^^^^^^^^^^^
> Package sssd-krb5-common requires itself?

Sorry, this was meant to be placed only in the part with the sssd-krb5
subpackage, I think I copied the Requires to both. New patch is
attached.
-------------- next part --------------
>From 283fa05ca001728b55203697f13fef3de3bc07a7 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 5 Jun 2013 14:03:41 +0200
Subject: [PATCH 1/2] rpm: Use hardened flags for RPM build

https://fedorahosted.org/sssd/ticket/1797

This patch adds the _hardened_build macro on platforms where it is
defined by the RPM. The macro amounts to compiling with cc
--spec=/usr/lib/rpm/redhat/redhat-hardened-cc1 and then linking with ld
--spec=/usr/lib/rpm/redhat/redhat-hardened-ld.

On Fedora 19, the gcc spec files contain -z now and fPIC or fPIE.
---
 contrib/sssd.spec.in | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 65832166bc141ad37e5d24bf3ed969aef260fc66..c48a5de9095d50d2ac8856b45a8c2ed9b040f7bf 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -41,6 +41,10 @@
 # Determine the location of the LDB modules directory
 %global ldb_modulesdir %(pkg-config --variable=modulesdir ldb)
 
+%if (0%{?fedora} > 15 || 0%{?rhel} >= 7)
+%define _hardened_build 1
+%endif
+
 Name: @PACKAGE_NAME@
 Version: @PACKAGE_VERSION@
 Release: 0 at PRERELEASE_VERSION@%{?dist}
-- 
1.8.2.1

-------------- next part --------------
>From 254a9f0a328ef3680df6cf301d550f0690e76ac7 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 5 Jun 2013 12:53:30 +0200
Subject: [PATCH 2/2] rpm: Split providers into separate subpackages

https://fedorahosted.org/sssd/ticket/1510

This patch splits the previously monolithic sssd package into sssd-common
that contains the deamon and the responders and per-provider packages
such as sssd-ldap or sssd-ipa.

This split would benefit two parties:
1) security auditors who are often trying to find the smallest package
   set including dependencies needed for the package to function.
   They would be able to i.e. install sssd-ldap and not bother
   about sssd-ipa or sssd-ad pulling in more dependencies.
2) 3rd party programs such as realmd or authconfig
   that would only be able to require or install on demand the
   needed packages.
---
 contrib/sssd.spec.in | 192 +++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 149 insertions(+), 43 deletions(-)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index c48a5de9095d50d2ac8856b45a8c2ed9b040f7bf..ff3ffa5f7434f87b4dab9d8d190dfa782ed7fe96 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -60,30 +60,13 @@ Patch0001:  sssd-1.9-man-change-default-ccache.patch
 
 ### Dependencies ###
 
-Requires: libldb >= 0.9.3
-Requires: libtdb >= 1.1.3
-Requires: sssd-client%{?_isa} = %{version}-%{release}
-Requires: libipa_hbac = %{version}-%{release}
-Requires: libsss_idmap = %{version}-%{release}
+Conflicts: sssd < %{version}-%{release}
+Requires: sssd-common = %{version}-%{release}
+Requires: sssd-ldap = %{version}-%{release}
+Requires: sssd-krb5 = %{version}-%{release}
+Requires: sssd-ipa = %{version}-%{release}
+Requires: sssd-ad = %{version}-%{release}
 Requires: python-sssdconfig = %{version}-%{release}
-Requires: cyrus-sasl-gssapi
-%if (0%{?use_systemd} == 1)
-Requires(post): systemd-units systemd-sysv
-Requires(preun): systemd-units
-Requires(postun): systemd-units
-%else
-Requires(post): initscripts chkconfig
-Requires(preun):  initscripts chkconfig
-Requires(postun): initscripts chkconfig
-%endif
-
-### Provides ###
-Provides: libsss_sudo = %{version}-%{release}
-Obsoletes: libsss_sudo < %{version}-%{release}
-Provides: libsss_sudo-devel = %{version}-%{release}
-Obsoletes: libsss_sudo-devel < %{version}-%{release}
-Provides: libsss_autofs = %{version}-%{release}
-Obsoletes: libsss_autofs < %{version}-%{release}
 
 %global servicename sssd
 %global sssdstatedir %{_localstatedir}/lib/sss
@@ -159,6 +142,40 @@ the system and a pluggable backend system to connect to multiple different
 account sources. It is also the basis to provide client auditing and policy
 services for projects like FreeIPA.
 
+The sssd subpackage is a meta-package that contains the deamon as well as all
+the existing back ends.
+
+%package common
+Summary: Common files for the SSSD
+Group: Applications/System
+License: GPLv3+
+Requires: libldb >= 0.9.3
+Requires: libtdb >= 1.1.3
+Requires: sssd-client%{?_isa} = %{version}-%{release}
+Conflicts: sssd < %{version}-%{release}
+%if (0%{?use_systemd} == 1)
+Requires(post): systemd-units systemd-sysv
+Requires(preun): systemd-units
+Requires(postun): systemd-units
+%else
+Requires(post): initscripts chkconfig
+Requires(preun):  initscripts chkconfig
+Requires(postun): initscripts chkconfig
+%endif
+
+### Provides ###
+Provides: libsss_sudo = %{version}-%{release}
+Obsoletes: libsss_sudo < %{version}-%{release}
+Provides: libsss_sudo-devel = %{version}-%{release}
+Obsoletes: libsss_sudo-devel < %{version}-%{release}
+Provides: libsss_autofs = %{version}-%{release}
+Obsoletes: libsss_autofs < %{version}-%{release}
+
+%description common
+Common files for the SSSD. The common package includes all the files needed
+to run a particular back end, however, the back ends are packaged in separate
+subpackages such as sssd-ldap.
+
 %package client
 Summary: SSSD Client libraries for NSS and PAM
 Group: Applications/System
@@ -174,7 +191,7 @@ service.
 Summary: Userspace tools for use with the SSSD
 Group: Applications/System
 License: GPLv3+
-Requires: sssd = %{version}-%{release}
+Requires: sssd-common = %{version}-%{release}
 
 %description tools
 Provides userspace tools for manipulating users, groups, and nested groups in
@@ -194,6 +211,72 @@ BuildArch: noarch
 %description -n python-sssdconfig
 Provides python files for manipulation SSSD and IPA configuration files.
 
+%package ldap
+Summary: The LDAP back end of the SSSD
+Group: Applications/System
+License: GPLv3+
+Conflicts: sssd < %{version}-%{release}
+Requires: sssd-common = %{version}-%{release}
+Requires: libsss_idmap = %{version}-%{release}
+Requires: sssd-krb5-common = %{version}-%{release}
+
+%description ldap
+Provides the LDAP back end that the SSSD can utilize to fetch identity data
+from and authenticate against an LDAP server.
+
+%package krb5-common
+Summary: SSSD helpers needed for Kerberos and GSSAPI authentication
+Group: Applications/System
+License: GPLv3+
+Conflicts: sssd < %{version}-%{release}
+Requires: cyrus-sasl-gssapi
+Requires: sssd-common = %{version}-%{release}
+
+%description krb5-common
+Provides helper processes that the LDAP and Kerberos back ends can use for
+Kerberos user or host authentication.
+
+%package krb5
+Summary: The Kerberos authentication back end for the SSSD
+Group: Applications/System
+License: GPLv3+
+Conflicts: sssd < %{version}-%{release}
+Requires: sssd-common = %{version}-%{release}
+Requires: sssd-krb5-common = %{version}-%{release}
+
+%description krb5
+Provides the Kerberos back end that the SSSD can utilize authenticate
+against a Kerberos server.
+
+%package ipa
+Summary: The IPA back end of the SSSD
+Group: Applications/System
+License: GPLv3+
+Conflicts: sssd < %{version}-%{release}
+Requires: sssd-common = %{version}-%{release}
+Requires: sssd-krb5-common = %{version}-%{release}
+Requires: libipa_hbac = %{version}-%{release}
+Requires: libsss_idmap = %{version}-%{release}
+Requires: bind-utils
+
+%description ipa
+Provides the IPA back end that the SSSD can utilize to fetch identity data
+from and authenticate against an IPA server.
+
+%package ad
+Summary: The AD back end of the SSSD
+Group: Applications/System
+License: GPLv3+
+Conflicts: sssd < %{version}-%{release}
+Requires: sssd-common = %{version}-%{release}
+Requires: sssd-krb5-common = %{version}-%{release}
+Requires: libsss_idmap = %{version}-%{release}
+Requires: bind-utils
+
+%description ad
+Provides the Active Directory back end that the SSSD can utilize to fetch
+identity data from and authenticate against an Active Directory server.
+
 %package -n libsss_idmap
 Summary: FreeIPA Idmap library
 Group: Development/Libraries
@@ -386,7 +469,11 @@ touch $RPM_BUILD_ROOT/%{mcpath}/group
 %clean
 rm -rf $RPM_BUILD_ROOT
 
-%files -f sssd.lang
+%files
+%defattr(-,root,root,-)
+%doc COPYING
+
+%files common -f sssd.lang
 %defattr(-,root,root,-)
 %doc COPYING
 %doc src/examples/sssd-example.conf
@@ -398,8 +485,6 @@ rm -rf $RPM_BUILD_ROOT
 %endif
 
 %dir %{_libexecdir}/%{servicename}
-%{_libexecdir}/%{servicename}/krb5_child
-%{_libexecdir}/%{servicename}/ldap_child
 %{_libexecdir}/%{servicename}/proxy_child
 %{_libexecdir}/%{servicename}/sssd_be
 %{_libexecdir}/%{servicename}/sssd_nss
@@ -409,17 +494,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/%{servicename}/sssd_ssh
 %{_libexecdir}/%{servicename}/sssd_sudo
 
-# RHEL 5 is too old to support the PAC responder
-%if !0%{?is_rhel5}
-%{_libexecdir}/%{servicename}/sssd_pac
-
-%endif
-
 %dir %{_libdir}/%{name}
-%{_libdir}/%{name}/libsss_ad.so
-%{_libdir}/%{name}/libsss_ipa.so
-%{_libdir}/%{name}/libsss_krb5.so
-%{_libdir}/%{name}/libsss_ldap.so
 %{_libdir}/%{name}/libsss_proxy.so
 %{_libdir}/%{name}/libsss_simple.so
 
@@ -427,7 +502,6 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/%{name}/libsss_child.so
 %{_libdir}/%{name}/libsss_crypt.so
 %{_libdir}/%{name}/libsss_debug.so
-%{_libdir}/%{name}/libsss_krb5_common.so
 %{_libdir}/%{name}/libsss_ldap_common.so
 %{_libdir}/%{name}/libsss_util.so
 
@@ -448,7 +522,6 @@ rm -rf $RPM_BUILD_ROOT
 %ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/group
 %attr(755,root,root) %dir %{pipepath}
 %attr(755,root,root) %dir %{pubconfpath}
-%attr(755,root,root) %dir %{pubconfpath}/krb5.include.d
 %attr(700,root,root) %dir %{pipepath}/private
 %attr(750,root,root) %dir %{_var}/log/%{name}
 %attr(711,root,root) %dir %{_sysconfdir}/sssd
@@ -459,10 +532,6 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/sssd/sssd.api.conf
 %{_datadir}/sssd/sssd.api.d
 %{_mandir}/man5/sssd.conf.5*
-%{_mandir}/man5/sssd-ipa.5*
-%{_mandir}/man5/sssd-ad.5*
-%{_mandir}/man5/sssd-krb5.5*
-%{_mandir}/man5/sssd-ldap.5*
 %{_mandir}/man5/sssd-simple.5*
 %{_mandir}/man5/sssd-sudo.5*
 %{_mandir}/man8/sssd.8*
@@ -472,6 +541,43 @@ rm -rf $RPM_BUILD_ROOT
 %{python_sitearch}/pysss.so
 %{python_sitearch}/pysss_murmur.so
 
+%files ldap
+%defattr(-,root,root,-)
+%doc COPYING
+%{_libdir}/%{name}/libsss_ldap.so
+%{_mandir}/man5/sssd-ldap.5*
+
+%files krb5-common
+%defattr(-,root,root,-)
+%doc COPYING
+%{_libdir}/%{name}/libsss_krb5_common.so
+%{_libexecdir}/%{servicename}/ldap_child
+%{_libexecdir}/%{servicename}/krb5_child
+
+%files krb5
+%defattr(-,root,root,-)
+%doc COPYING
+%{_libdir}/%{name}/libsss_krb5.so
+%{_mandir}/man5/sssd-krb5.5*
+
+%files ipa
+%defattr(-,root,root,-)
+%doc COPYING
+# RHEL 5 is too old to support the PAC responder
+%if !0%{?is_rhel5}
+%{_libexecdir}/%{servicename}/sssd_pac
+%endif
+
+%attr(755,root,root) %dir %{pubconfpath}/krb5.include.d
+%{_libdir}/%{name}/libsss_ipa.so
+%{_mandir}/man5/sssd-ipa.5*
+
+%files ad
+%defattr(-,root,root,-)
+%doc COPYING
+%{_libdir}/%{name}/libsss_ad.so
+%{_mandir}/man5/sssd-ad.5*
+
 %files client -f sssd_client.lang
 %defattr(-,root,root,-)
 %doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
-- 
1.8.2.1



More information about the sssd-devel mailing list